T06 · System Persistence
Warning
- Location
- SKILL.md:183
- Finding
- Persistent Daily Command Execution Through a Cron Task## Vulnerability Details **File Location**: `SKILL.md`, lines 183–189 **Vulnerability Type**: Persistent scheduled execution **Risk Level**: Medium **Complete Code Snippet**: ```bash cron add --name "daily-wuxing-reminder" \ --schedule "17 8 * * *" \ --command "python3 /path/to/daily_fortune.py <day-master>" ``` ### Technical Analysis The Skill directs the Agent to register a cron task that invokes a Python script every day. Unlike a one-time calculation, this scheduled command survives the interaction in which it was created and continues executing unattended. The currently referenced `daily_fortune.py` implementation was reviewed and contains no malicious behavior. Nevertheless, persistence is established at the system or Agent-platform level. The scheduled command relies on a mutable filesystem path, so replacing or modifying the referenced script after task creation would change the code executed by the persistent task without requiring the cron entry to be recreated. This behavior is presented as a daily reminder feature rather than concealed as a backdoor. However, the instructions do not show an explicit confirmation step immediately before persistence is created, an integrity check for the executed script, or a corresponding command for removing the task. ### Attack Path 1. A user asks the Agent to configure a daily fortune reminder. 2. The Agent follows the instructions in `SKILL.md`. 3. The Agent registers the `daily-wuxing-reminder` cron task. 4. The task persists beyond the current conversation and invokes Python every day. 5. If an attacker or another process can subsequently modify or replace the script at the configured path, attacker-controlled code executes at the next scheduled run. 6. Execution occurs with the permissions of the account or service responsible for running the cron task. ### Impact Assessment The direct impact is persistent, unattended command execution with the priv ...[truncated 584 chars]
- Remediation
- ## Remediation Suggestions 1. Require explicit, informed user confirmation immediately before creating the scheduled task. 2. Display the exact schedule, executable, arguments, execution identity, and persistence implications before confirmation. 3. Use a canonical absolute path located in a directory that unprivileged or unrelated processes cannot modify. 4. Restrict ownership and permissions on both the Python script and its parent directories. 5. Prefer a platform-native notification scheduler that does not permit arbitrary command execution. 6. If command scheduling is unavoidable, use an allowlisted launcher that invokes only the intended operation. 7. Validate the script's integrity before each execution, such as by checking a trusted cryptographic hash. 8. Document and expose a removal command for the scheduled task. 9. List the resulting task after creation and verify that its schedule and command match the user's approved configuration. 10. Avoid creating the task automatically merely because the Skill was loaded or because reminder functionality was discussed.